ELK to resolve IIS username to show fullname of the user

Take a look at this thread, which is solving a slightly different problem. It suggests exporting AD data and then using either a translate filter or an elasticsearch lookup into the exported data.